It took a few days for privacy law experts to read and analyze the Conservatives’ new Digital Privacy Act, but when they did a number of them observed how similar it was to the Harper government’s previous attempt to amend the Personal Information Protection and Electronic Documents Act (PIPEDA), Bill C-29.

University of Ottawa law professor Michael Geist was an exception.

In a blog post earlier this week, Geist highlighted one particularly concerning change in this iteration: Bill S-4 would amend the laws governing the warrantless disclosure of personal information.

The concerning part in question will, in a nutshell, allow one organization to provide another with an individual’s personal information without their knowledge or consent — though only when a law has or is about to be broken and requiring disclosure and consent could jeopardize an investigation.

In Geist’s opinion, there are some troublesome implications.

He uses the example of an internet provider disclosing names and IP addresses to a film production company alleging copyright infringement, as in a recent case involving TekSavvy and Voltage Pictures.

“If Bill S-4 were the law, the court might never become involved in the case. Instead, Voltage could simply ask TekSavvy for the subscriber information, which could be legally disclosed (including details that go far beyond just name and address) without any court order and without informing their affected customer,” he wrote.

“In fact, the potential use of this provision extends far beyond copyright cases. Defamation claims, commercial battles, and even consumer disputes may all involve alleged breaches of agreements or the law. While the organization with the personal information (telecom companies, social media sites, local businesses) might resist disclosing information without a court order, the law would not require them to do so.”

When asked to respond, Industry Canada pointed to the rules organizations must follow and the consequences they may face for failing to do so.

“Companies who share personal information are required to comply with the rules to ensure that information is only disclosed for the purpose of conducting an investigation into a contravention of a law or breach of an agreement. For example, self-regulating professional associations, such as a provincial law society, may wish to investigate allegations of malpractice made by a client,” the department replied by email.

“When organizations are sharing private information, the Privacy Commissioner can investigate violations and may take legal action against companies who do not follow the rules. This is consistent with privacy laws in British Columbia and Alberta and was recommended by the Standing Committee Access to Information, Privacy and Ethics.”